Hi,
Thanks for your kind words. I would encourage you to create a support ticket in future if you have questions/concerns about the plugin.
As per your question, please try deactivating and activating the plugin again. The plugin adds a block of code in your .htaccess file that ensures the files are private and should not accessible with a direct link by public.
If reactivating the plugin doesn’t fix the issue, please check your .htaccess file and find if there is a block of code that looks something like the below:
# BEGIN User Private Files
# The directives (lines) between "BEGIN User Private Files" and "END User Private Files" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
RewriteRule ^wp-content/uploads/upf-docs/(.*)$ https://YOURSITE.COM?file=$1 [QSA,L]
# END User Private Files
If you don’t see the code above, please add it and replace https://YOURSITE.COM with your site’s address.
If the issue persists, please try deactivating other plugins and test. Let me know what you find out.